Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!think.com!spool.mu.edu!uunet!lll-winken!news.arc.nasa.gov!haven.umd.edu!uvaarpa!murdoch!astsun7.astro.Virginia.EDU!gl8f
From: gl8f@astsun7.astro.Virginia.EDU (Greg Lindahl)
Newsgroups: comp.org.eff.talk
Subject: Re: Student suspended for distributing /etc/passwd
Message-ID: <1991Jun24.015950.27226@murdoch.acc.Virginia.EDU>
Date: 24 Jun 91 01:59:50 GMT
Article-I.D.: murdoch.1991Jun24.015950.27226
References: <8589@awdprime.UUCP> <8670@awdprime.UUCP> <8711@awdprime.UUCP>
Sender: usenet@murdoch.acc.Virginia.EDU
Organization: Department of Astronomy, University of Virginia
Lines: 79

In article <8711@awdprime.UUCP> mbrown@testsys.austin.ibm.com (Mark Brown) writes:

>I guess *I* wasn't clear.
>
>_Who_decides_evil_intent_?
>_Do_I_have_to_determine_intent_every_time_an_alarm_goes_off_?


I guess we're batting 0 for 2 here.

I don't need to decide intent very often. Because I have, I think,
fairly carefully checked security on my system, I don't care if the
COPS runner has evil intent or not, because odds are they aren't going
to find anything.

>I posit that it is labor-intensive and potentially harmful to users to be
>forced to question their "intent" all the time.

An ounce of prevention is worth 10 pounds of harrassment of the poor
users.

>I posit that notification in advance, while not only GOOD MANNERS, also
>frees me to check on *real* attempts without wasting time (on my part, or
>on the students' when she is investigated for "attempting to crack the
>system").

But why should I have to inform you about doing what I consider to be
routine things? "Oh, I'm testing a program that uses fork(), I just
wanted to warn you because there's a slight chance that I might have
reversed some tests and could accidentally crash the system. Want to
read my code just in case".

Or, how about: "I'm about to type in a line to the shell, and you know
that no matter what I set out to type, I could accidentally fill up
the disk or something so you better review each line before I type it,
OK?"

The point I am attempting to illustrate is that on what I consider to
be a reasonably secure system, the admin does not need to worry about
users running COPS.

>| Which means you think it's OK to say "no" ?
>
>Yes, if I, as system admin, determine
>	o your device is potentially destructive
>	o your device is wasteful and you want to use it during peak time

That's fine. These are the same criteria every admin uses to evaluate
anything, at least I do.

But the original thread was about a sysadmin who says "no one can run
COPS without my permission", and it was pretty clear that he would
deny permission on other grounds, like "well, I don't know you and I
don't trust you, so no, you can't."

>If you wanted to run COPS most any time, that's not a problem, but
>only because I know COPS.

Indeed, so one might wonder why you jumped into a thread about COPS. I
only brought up intent at all to show that it's silly to deny ALL
users the right to run COPS. That's all it was mentioned for.

>Your administrator may not know COPS from anything else -- what's the use
>in scaring her when you can be polite and ask in advance?

If I run into an administrator who has big holes that can be spotted
by COPS, I don't want to use his machine. Period. I'm out of there. I
don't understand why I should spend any of my time telling any
sysadmin that I am about to do something that's totally ethical and
legal.

>I'm glad you have the time to deal with every "system tester" that comes
>along.

I've ignored them totally, and have had no problems. My system passes
the non-password portion of COPS, and I pass around memos giving
people hints on how to pick good passwords. That's the ounce of
prevention. The pay-off is that I don't have to be paranoid about
people reading world-readable files.